Fluphone was conceived as part of an ESRC/MRC funded project during the H1/N1 Epidemic to understand the parameters of of the disease, and to map the actual spread potentially more accurately than ever done before. The project had epidemiologists, public health authorities and even psychologists as partners. We were briefed at the start about the worst case scenarios. Recall that during the early onset, in Mexico, mortality rates approaching 50% were reported. It was some time before it was understood that this was in extremely poor areas where there was low healthcare, and high levels of other diseases (e.g. respitory) in the population. However note that the Spanish Flu Pandemic of 1918 hit only a few percent but was massively disruptive to society. At a certain point, quarantine starts to mean that tanker drives can't deliver gas to petrol stations, so trucks stop being able to deliver food to supermarkets, and modern society collapses catastrophically. Against this apocalyptic backdrop, we thought: Hey, lets write an app to use on smart phones to track the disease. Of course, we can't detect that someone is infected without some medical breakthrough in sensors, but people could self report symptoms, and (with their GP) confirm them. What we had was experience of tracking encounters between people. We use the short range nature of the Bluetooth radio present on almost all phones. Each radio beacons with a given ID, and this uniquely identifies the phone (and therefore, most likely, the individual present, within 1-5 meters of another. We had used this technique in the past to build models of human encounter statistics, which, when coupled with fixed Bluetooth base-stations, or else with self-reports from phones of their location (e.g. based on their own detection via wifi AP or cell tower triangulation, or else GPS in the phone), can allow us to understand something about the way people behave spatially over time. Interesting to architects, transportation system designers, and, now, suddenly, public health epidemiologists. Diseases can be transmitted via a number of vectors, but in most cases, proximity is key (exceptions include SARS where a previous infected person can leave a trace on a physical object which can infect someone quite a long time later). Flu is transmitted typically by one of 3 vectors: direct sneezing on someone, sneezing leaving droplets in the air which someone soon after walks through, or (like SARS) sneezing on some thing, which someone soon after touches. The first two cases are most common. Often, a new flu virus has a new mix of vectors. Characteristics of interest for the epidemic include the vectors incubation period (how long between catching and becoming infectious) infectious period (how long I carry and can infect) infectiousness (chance if I have it that I give it) susceptibility distribution (e.g. any groups immune, any groups more susceptible) recovery (or death:) (these are collectively known as the SIR model - there are a lot of refined versions, but this will suffice to illustrate for now) secondary things of interest include things like can you catch it again! is there a vaccine (or more than one) being tried or any other treatment, preventative or otherwise... So we thought two things would help 1/ If we can get ground truth (e.g. from medically tested people), we can then go through contact reports and identify the flow of the disease from person to person and then fit to an SIR model - if this is done early in the epidemic, we can establish how bad the peak will be (pandemic or otherwise) and how long it will last - this allows some planning of resources by the medics (and or army:) 2/ we could actually warn people (dashboard style):- i) hey, don't meet person X as they just reported disease or else they just met person Y who reported having it... ii) hey, don't go to place P because lots of people with the disease are/have been/will be going there... (like an anti-recommendation system:) So we went to the medical ethics board and encountered some difficulties... They were enthusiastic about 1/ one they got it, but 2/ was definitely not going to happen Lets look at what we had to do to convince them... 1. we made sure data was captured accurately 2. we made sure it was logged securely both network transfer, and database, were encrypted 3. only 2 named researchers had access to the data at all 4. records were pseudanonymized (re-identification might be possible, when combined with other data - e.g. an electoral role or social media accounts - but no-one but the two named researchers had the data, and there were, as yet, no reasons to re-identify anyone:) 5. the data would be deleted at the end of the research. This sufficed to get an OK for the experiment except for one very serious condition: We were not allowed to record data for minors To be accurate, we couldn't actually stop a minor downloading the app and running it and lying about their age, but they'd have to have clicked on the agreement that they were an adult... This limitation renders the data a lot less useful for goal 1 and almost completely useless for goal 2 - Goal 2 was also completely disallowed, so we had to remove all capability for running an early warning system - The ethics v. pragmatics for 1 are unclear - children are a major part of the social graph, and, during school time, are one of the main mix-zones for diseases so act to spread disease faster (if they are more susceptible, which is often the case, and turned out to be for H1 - indeed, H1N1 turned out to be related to a flu outbreak some 40 years earlier, and many older people (over 50) had pretty good immunity. One thing the data did reveal is that this sub-community (part of the large component of the encounter graph) acted as a-symptomatic carriers) (note another lesson, by the way, is that closing schools during a flu pandemic is wrong, as parents just share childcare duties, and kids end up mixing more in each others homes, even than in schools!) for 2, we were told the risk of informing people of who (and where) was dangerous were that in the event of genuine high mortality pandemics, this might be used by vigilantes (burn down these houses) so was just too risky - as a general principle, "interventions" aren't usually allowed in medical research - this, we CS folks found bizarre, since most medical research (e.g. a drug trial) is an intervention by definition. The rules I read elsewhere say that you must do something that as far as current knowledge goes, is at least as good as best current practice. I don't see how the medical ethics board followed this principle in reducing the effectiveness of our goal 1, and removing goal 2. On 2nd thoughts, we over-reacted removing location data from logs (although stopping the "dashboard of death" was probably the right thing to do). Conclusions:- Measuring stuff accurately on a large scale is doable - explaining the cost/benefit and best practice in terms of care about ethical considerations (do no harm etc) to non-techies can be tricky... An aside: two earlier experiments in using blue tooth to track people had bad ethical consequences due to poor design 1/ Intel research tracked 100 employees for a few weeks - the experimenter noticed and identified two employees seemed to be together all night long - it was only later revealed by them that they'd started dating - this was a failure to anonymise the data adequately 2/ a similar measurement of blue tooth in public areas of Bristol detected a new social meme, the use of blue tooth names on devices to declare sexual preferences in (gay) bars- it seems like this sort of thing could have been handled a bit more sensitively.